github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #225] [rfe] add option to blacklist all `~/.*` directories #158

New issue

Closed

opened 2026-05-05 05:11:54 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 05:11:54 -06:00

Owner

Originally created by @genodeftest on GitHub (Jan 13, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/225

In many cases you need to blacklist all but a few "dot" directories in ${HOME}. This is because applications should usually not have access to config files of most other applications. Is there any simple way to do this? If not implementing such a feature would be nice.

A general option for that would be nice, since blacklisting is always risky since whoever wrote the config might have missed something.

With this option one could get rid of most blacklist config options, including most of etc/disable-common.inc and etc/disable-secret.inc.

Originally created by @genodeftest on GitHub (Jan 13, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/225 In many cases you need to blacklist all but a few "dot" directories in ${HOME}. This is because applications should usually not have access to config files of most other applications. Is there any simple way to do this? If not implementing such a feature would be nice. A general option for that would be nice, since blacklisting is always risky since whoever wrote the config might have missed something. With this option one could get rid of most `blacklist` config options, including most of etc/disable-common.inc and etc/disable-secret.inc.

gitea-mirror

2026-05-05 05:11:54 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:12:00 -06:00

Author

Owner

@the8472 commented on GitHub (Jan 13, 2016):

What about using whitelist instead of blacklist?

@the8472 commented on GitHub (Jan 13, 2016): What about using whitelist instead of blacklist?

gitea-mirror commented

2026-05-05 05:12:01 -06:00

Author

Owner

@genodeftest commented on GitHub (Jan 13, 2016):

"Blacklist all but a few" essentially is whitelisting. I meant ~/.* directories should generally be forbidden, but they can still be whitelisted.

@genodeftest commented on GitHub (Jan 13, 2016): "Blacklist all but a few" essentially is whitelisting. I meant `~/.*` directories should generally be forbidden, but they can still be whitelisted.

gitea-mirror commented

2026-05-05 05:12:03 -06:00

Author

Owner

@the8472 commented on GitHub (Jan 13, 2016):

Yes, but I mean if you use the whitelist feature then everything else in the home dir is automatically blacklisted, which obviously includes the dot dirs.

@the8472 commented on GitHub (Jan 13, 2016): Yes, but I mean if you use the whitelist feature then everything else in the home dir is automatically blacklisted, which obviously includes the dot dirs.

gitea-mirror commented

2026-05-05 05:12:06 -06:00

Author

Owner

@genodeftest commented on GitHub (Jan 13, 2016):

I just want to blacklist the ~/.* directories. That's why I opened this issue.

An example: Your PDF viewer might need access to some config files in ~/.local and ~/.config, but it doesn't need access to any other ~/.* folder. It needs access to things like Desktop and Downloads directory, so those should probably be allowed. Since users sometimes have other directories below ${HOME} with relevant non-config/non-cache data in it, I won't blacklist everything but those two directories.

I haven't figured out how to whitelist all directories in ${HOME} not starting with a .. That's what I need.

(Sorry for being complicated, English is not my first language.)

@genodeftest commented on GitHub (Jan 13, 2016): I just want to blacklist the `~/.*` directories. That's why I opened this issue. An example: Your PDF viewer might need access to some config files in ~/.local and ~/.config, but it doesn't need access to any other `~/.*` folder. It needs access to things like Desktop and Downloads directory, so those should probably be allowed. Since users sometimes have other directories below `${HOME}` with relevant non-config/non-cache data in it, I won't blacklist everything but those two directories. I haven't figured out how to whitelist all directories in ${HOME} not starting with a `.`. That's what I need. (Sorry for being complicated, English is not my first language.)

gitea-mirror commented

2026-05-05 05:12:09 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 14, 2016):

OK, I'll add a --blacklist-alldotfiles option!

@netblue30 commented on GitHub (Jan 14, 2016): OK, I'll add a --blacklist-alldotfiles option!

gitea-mirror commented

2026-05-05 05:12:11 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 6, 2016):

It is working today:

$ firejail --blacklist=.*

All dot files under home are blacklisted.

@netblue30 commented on GitHub (Mar 6, 2016): It is working today: ``` $ firejail --blacklist=.* ``` All dot files under home are blacklisted.

gitea-mirror referenced this issue

2026-05-05 05:32:23 -06:00

[GH-ISSUE #402] Add recursive read-only option #289

gitea-mirror referenced this issue

2026-05-05 08:08:21 -06:00

[GH-ISSUE #2200] --read-only recursiveness does not cross filesystem boundaries #1471

gitea-mirror referenced this issue

2026-05-05 08:25:13 -06:00

[GH-ISSUE #2792] Wiki: Frequently Asked Questions #1747